Flux
Toutes les catégories

Cybersécurité

228 articles

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Cybersécurité Programmation

Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud

Update, September 25, 2026: both actions-cool/issues-helper and actions-cool/maintain-one-comment have been disabled on GitHub again, so workflows referencing them now fail at job setup instead of running the payload. Two actions-cool GitHub Actions, issues-helper and maintain-one-comment, were compromised and disabled during the May 2026 Mini Shai-Hulud campaign. Both became reachable again on September 16, 2026, and their release tags still point to malicious code, so every workflow that…

Socket
Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts
Cybersécurité Programmation

Malicious Firefox Extension Poses as PDF Identity Verifier to Hijack Google Accounts

Socket identified a Firefox extension that ships with no hardcoded malicious code and fetches a remote payload after installation to silently automate Google account takeover, targeting Portuguese- and Spanish-speaking users since September 11, 2026. Socket's Threat Research team identified a malicious Firefox extension posing as a utility for identity verification before opening protected PDF documents. The extension, pdf-para-texto@extensao.local, was published to the Firefox Add-ons store on…

Socket
MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack
Cybersécurité Programmation

MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack

The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Its main GitHub repository has about 11,500 stars and 1,100 forks. Four malicious releases, three of the npm package @memtensor/memos-cloud-openclaw-plugin and one of the PyPI package MemoryOS, each currently the latest version on its registry, drop cross-platform Go binaries that search developer home directories for secrets and report to servers under skyleen[.]fr.…

Socket
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Cybersécurité Programmation

Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source

Lovable is beginning to replace Vite inside its cloud preview environments with OJ, a Rust-based build tool created for the demands of running around one million short-lived development sandboxes per day. The company reported that OJ reduced median sandbox acquisition time from 14.5 seconds to 3 seconds and cut the memory used by the dev server process by roughly 6.5x in a controlled production rollout. OJ arrives as part of the trend toward rewriting JavaScript tooling in Rust. Other examples…

Socket
Happy Birthday, Shai-Hulud
Cybersécurité Programmation

Happy Birthday, Shai-Hulud

This week marks one year since an attacker pushed a malicious version of @ctrl/tinycolor to npm, kicking off the worst year for npm security on record. At the time, the package was downloaded more than two million times a week. Within a day the same code was spreading on its own across dozens of packages, and then into CrowdStrike's npm namespace. It was the first known self-propagating worm in the npm ecosystem, and it has not really stopped since. The tinycolor compromise put software supply…

Socket
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Cybersécurité Programmation

PolinRider Spreads Through Compromised GitHub Accounts and Packagist

Socket researchers identified malicious code in the dev-main version of visanduma/nova-two-factor, a Packagist package with more than 700,000 cumulative downloads, as the PolinRider campaign continues to spread through compromised developer accounts and Git repositories. The Socket Threat Research Team continues to track malicious activity associated with PolinRider. In our July research post, we provided initial technical details about this persistent campaign, which distributes malware across…

Socket
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
Cybersécurité Programmation

GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk

GitHub has added cache-mode to GitHub Actions, a new setting that limits how workflows and jobs can access the Actions cache. It targets cache poisoning, the technique attackers used to compromise the Ultralytics PyPI package in 2024 and the TanStack npm packages in May 2026. Cache poisoning works because an entry written to the shared Actions cache in one context can be restored and run in another. An attacker who gains write access to a cache key that a trusted workflow later reads can plant…

Socket
Jerod Santo Joins Socket as Head of Media
Cybersécurité Programmation

Jerod Santo Joins Socket as Head of Media

We need to talk. Supply chain attacks are going parabolic in both frequency and impact. There are so many hacks now that we gussy ‘em up with names like GemStuffer, SANDWORM_MODE, and TrapDoor just to keep track of the onslaught. (Remember Heartbleed? The O.G. (Original Gussy)) We’ve also got frontier models escaping their sandboxes to hack third parties, zero-click worms spreading through WeChat without any user interaction, AI-discovered zero days being used by criminal enterprises, and so…

Socket
Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
Cybersécurité Programmation

Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service

Socket’s Threat Research Team identified a cross-store browser extension, “Twitch Enhanced Viewer | JeetBot,” that forwards each user’s live Twitch OAuth session token to proxy servers operated by a Russian commercial bot service. The extension ships on both the Chrome Web Store (extension ID pnhhdhhcadcjfckjhpmjneldiegbojfb, 30,000 users) and Firefox Add-ons (twitchenhancedviewer@example.com, 552 users). Both listings are live at time of writing. Current builds (v85.x) forward the token inline…

Socket
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Cybersécurité Programmation

Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack

Anthropic has revised its assessment of the Claude cybersecurity evaluation incidents it disclosed in July. What it initially described as primarily a containment and operational failure also exposed two recurring alignment problems: models selectively interpreted evidence to justify continuing their work, then kept pursuing their assigned task despite the risk of real-world harm. Anthropic identified those behaviors as biased reasoning and recklessness in its latest alignment assessment: Our…

Socket
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Cybersécurité Programmation

Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data

Socket uncovered a cross-browser extension operation targeting cryptocurrency traders. Four malicious Chrome and Firefox extensions steal authenticated Axiom Trade and Padre session and wallet-related data, while two earlier extensions linked to the same publisher operation reveal a longer-running pattern of repackaging crypto trading tools. The Socket Threat Research team identified six Chrome and Firefox extensions linked through a combination of shared code, command and control (C2)…

Socket
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
Cybersécurité Programmation

GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing

OpenAI has released GPT-6 Astra, its first model to reach the company’s Critical cybersecurity capability threshold, with a perfect score on the public ExploitBench benchmark and autonomous discoveries of exploitable zero-day vulnerabilities in browser and operating system targets. There is something unintentionally comical about the generational comparison in OpenAI’s announcement. Astra is the more sophisticated, better-aligned guest you can trust at a formal dinner party, excelling at…

Socket
Microsoft Teams Notifications Are Now Available in Socket
Cybersécurité Programmation

Microsoft Teams Notifications Are Now Available in Socket

Today, we’re excited to add Microsoft Teams as a notification channel in Socket. Security and engineering teams can now send organization alerts and supply chain attack campaign notifications directly to the Teams channels they already monitor, with filters that control exactly which events reach each destination. When Socket finds something that needs attention, teams shouldn’t have to keep another dashboard open to find out. Microsoft Teams notifications bring relevant security activity into…

Socket
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
Cybersécurité Programmation

pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%

pnpm 12 is now stable, replacing the package manager’s Node.js and TypeScript foundation with a Rust rewrite while preserving the commands, settings, and lockfile format used by pnpm 11. Early results from a large production monorepo show install times falling by as much as 90%, although a dispute over flawed and outdated package manager benchmarks has complicated broader claims about where pnpm now ranks against Bun and other rivals. Released August 26, pnpm 12 is designed to be a major…

Socket
6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat
Cybersécurité Programmation

6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat

Socket CTO Ahmad Nassri recently sat down with five other AppSec leaders on The Secure Disclosure podcast for an unfiltered discussion on the state of software supply chain security. Hosting six competing CTOs and security researchers in one room provided a candid look at how upstream threats are evolving, the operational limits of package registries, and why commercial threat intelligence siloing leaves engineering teams exposed. A few of the highlights: Vulnerabilities vs. Active Malicious…

Socket